Security notice
Do you still keep old card numbers on your store? Bob Shop says an attacker copied older card records and the key that unlocked them.
On November 12, 2026, Bob Group, which runs the South African online marketplace Bob Shop, emailed customers about unauthorized access to parts of its systems on October 30 and 31. The attacker reached the Bob Shop database that holds customer and seller accounts and older partial payment records. The last recorded activity was on November 1. Bob Group says those older card records include cardholder names, card numbers and expiry dates. The card numbers were stored encrypted, but the encryption key was also copied, so the card numbers should be treated as exposed. The records do not include card security codes (CVVs). The attacker could also reach account names, email addresses, usernames and hashed passwords. Bob Group says it has no evidence those account details were read, but it cannot rule it out, and it is treating the information as if it was accessed, though not all users may have been affected. This is not a named software flaw, so there is no CVE or patch to install. If you bought something on Bob Shop with a card, check your statements and change reused passwords. If you run a store, this is a reminder not to keep old card data, and to protect encryption keys as carefully as the records themselves. (TechCentral, Nov 12; MyBroadband, Nov 12)
What happened
- Access on October 30 and 31. Bob Group says an unauthorized party gained access to parts of its systems on October 30 and 31, 2026, and reached the Bob Shop database that holds customer and seller accounts and older partial payment records. It says all identified access routes have been closed, and that the last recorded activity was on November 1. (TechCentral, Nov 12; MyBroadband, Nov 12)
- Customers told on November 12. Bob Group emailed buyers who paid by card. TechCentral and MyBroadband both quote that email, which was signed by Bob Group CEO Anita Erasmus. The company says it has reported the breach to South Africa's Information Regulator, as the Protection of Personal Information Act requires, and has told its acquiring bank, which was asked to notify the card schemes so that card issuers can watch for fraud. It says it does not yet know who was responsible. (TechCentral, Nov 12; MyBroadband, Nov 12)
- Card data removed on November 1. Bob Group says that on November 1 it removed historical card numbers, names and expiry dates from the live Bob Shop database and replaced the encryption key. It also ended all active sessions and replaced exposed passwords, keys and system credentials. It says it has preserved evidence for the investigation and started further security improvements across Bob Group systems. (TechCentral, Nov 12; MyBroadband, Nov 12)
- Extra checks on seller payouts. Bob Group says it has put more stringent approval processes on all payouts and is holding every change of payout bank details until it is confirmed. Seller accounts were in the breached database. The customer notice, sent to buyers who paid by card, does not say whether any seller payouts were affected. (TechCentral, Nov 12; MyBroadband, Nov 12)
What data
Bob Group has not published a count of affected customers or cards. The details below come from the customer email quoted by TechCentral and MyBroadband. (TechCentral, Nov 12; MyBroadband, Nov 12)
- Older partial payment records: cardholder name, card number and expiry date. Bob Group says the card number was stored in encrypted form, but the encryption key was also copied, so the card number should be treated as exposed. It says the record does not contain the card security code (CVV).
- Account details the attacker could reach: names, email addresses, usernames and passwords, with passwords stored in hashed form. Bob Group says it has no evidence these account details were read, but it cannot rule it out. It says it is treating the information as if it was accessed, although not all users may have had their information accessed.
Who should worry
- You bought something on Bob Shop with a card, or you have a Bob Shop customer or seller account.
- You run an online store or marketplace that still keeps card numbers, or that pays sellers.
If you have never used Bob Shop and you do not run a store that keeps card or account data, this notice does not apply to you.
What to do now
If you are a Bob Shop customer. This follows Bob Group's advice.
- Check your card statements and report any transaction you do not recognize to your bank at once. (MyBroadband, Nov 12)
- Never share your card security code (CVV), one-time PIN (OTP) or banking password with anyone who contacts you. (MyBroadband, Nov 12)
- Change your Bob Shop password, and if you use the same password on other websites, change it there too. (MyBroadband, Nov 12)
- Watch for fake emails, texts and calls. Bob Group says it will never ask you for your password, card number, card security code (CVV), one-time PIN (OTP) or banking log-in details, and it will never ask you to change bank details by email. (MyBroadband, Nov 12)
If you run an online store. These are general steps, not from Bob Group. We are not claiming any tool, including EverThread, would have stopped this attack.
- Do not keep card numbers you do not need. Bob Group's notice is about older partial payment records, not only live checkouts. Review what your store, plugins and payment tools still keep, including old orders, and delete what you no longer need.
- Protect the key as carefully as the records. Encrypting card numbers does not help if the encryption key is copied too. If you must keep card data, keep the key separate from the records, limit who can reach it, and have a plan to replace it.
- Treat hashed passwords as sensitive. Bob Group says the account passwords were stored hashed, and that those details could be used to try to log in to Bob Shop or, if the same password is used elsewhere, to other websites. Ask customers to use a password they do not use anywhere else, and offer two-step sign-in if your platform supports it. (MyBroadband, Nov 12)
- Add extra checks before you change seller payout details. Bob Group tightened approval on payouts and is holding payout bank-detail changes until they are confirmed. If you pay sellers, vendors or affiliates, require a confirmed request before you change where the money goes.
- Have a plan before you need one. Know how you would tell customers, notify a regulator, and alert your payment provider or acquirer, including who can make those calls after hours.
What to send your developer, agency or host
Bob Group, which runs the South African marketplace Bob Shop, told customers on November 12, 2026 that an attacker reached its Bob Shop database on October 30 and 31 and copied older encrypted card records along with the encryption key. Cardholder names, card numbers and expiry dates should be treated as exposed. CVVs were not included. Account names, emails, usernames and hashed passwords were reachable; Bob Group says it has no evidence those were read, but it cannot rule it out. Please tell us whether we still keep card numbers, names or expiry dates, including on old orders, where any encryption keys are stored, and how we would replace a key if we had to. Please also tell us how we would force password resets, whether customers can use two-step sign-in, and what checks we use before changing seller or vendor payout bank details. Source: Bob Group customer email of November 12, 2026, as reported by TechCentral and MyBroadband.
Common questions
Has my site been hacked?
This notice does not mean your site has been hacked. It is about a breach of Bob Shop's own systems. It matters to you as a shopper if you used that marketplace, and as a store owner because many shops still keep old card records, account passwords and seller payout details.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see your store's customer records, stored card data, encryption keys or passwords, and we cannot tell you whether you were one of Bob Shop's customers.
How did the attacker get in?
Bob Group has not said. It says the investigation is ongoing and that it does not yet know who was responsible. (TechCentral, Nov 12; MyBroadband, Nov 12)
Were card security codes (CVVs) stolen?
Bob Group says the card records do not contain the card security code (CVV). The records do include cardholder names, card numbers and expiry dates, and the company says those card numbers should be treated as exposed because the encryption key was also copied. (TechCentral, Nov 12; MyBroadband, Nov 12)
Is there anything to update?
No. This was an attack on one company's marketplace, not a named flaw in software you run. The general steps for store owners above are worth doing anyway.
Where can I follow official updates?
TechCentral's report and MyBroadband's report, both of which quote Bob Group's November 12 customer email. We did not find a public notice on Bob Shop's website when we checked on November 12, 2026. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- TechCentral: Bob Shop hackers copied card numbers and the key to unlock them, November 12, 2026, checked November 12, 2026
- MyBroadband: Top South African e-commerce platform suffers data breach which includes users' credit card details, November 12, 2026, checked November 12, 2026